How this actually works
The point where DRM and TLS knowledge extended outward into DNS, TCP/UDP, and traffic filtering, using this domain as the live target the whole way through. Every value below was fetched when this page rendered — not a snapshot.
01
The stack, top to bottom
L7 · ApplicationHTTP requests/responses — what proxy.ts and each subdomain handler work with
L6/5 · Presentation / SessionTLS — see Phase 3: SNI plaintext before decryption, a real wildcard cert after
L4 · TransportTCP vs UDP — see Phase 4: real ESTABLISHED/TIME_WAIT state, and UDP's total absence of it
L3 · NetworkIP routing — the A records below, all landing on Vercel's anycast pool
L2/1 · Data Link / Physicaloutside what this lab can observe from a cloud sandbox
02
Live DNS lookup
it.shmuky.dev
- A
- 216.150.16.1, 216.150.1.1
- NS
- (not returned to a recursive query here — see Phase 1)
A live recursive lookup, not a step-by-step trace — dig +trace on your own machine (Phase 0) shows the root → .dev → shmuky.dev walk this can't reproduce server-side.
03
Live echo.it.shmuky.dev output
{
"subdomain": "echo",
"receivedAt": "2026-09-20T20:27:29.039Z",
"host": "echo.it.shmuky.dev",
"clientIp": "3.83.202.236",
"edge": {
"forwardedProto": "https",
"vercelId": "cle1:iad1::cvlbp-1789936048974-df5b7ec88c39",
"region": "iad1"
},
"tlsVisibility": {
"note": "TLS is terminated at Vercel's edge before this function runs. Cipher suite, TLS version, and the raw ClientHello (including SNI) are not visible to this code — only the forwarded headers below are.",
"whatsActuallyVisibleHere": [
"x-forwarded-proto (http vs https, not the TLS version)",
"host (the SNI value the edge routed on, after the fact)",
"x-vercel-id (routing/debug id, not TLS metadata)"
],
"whatsOnlyVisibleOnTheWire": [
"the ClientHello SNI field, in plaintext, before decryption",
"the negotiated TLS version and cipher suite",
"the certificate chain actually served"
]
},
"headers": {
"accept": "*/*",
"accept-encoding": "br, gzip, deflate",
"accept-language": "*",
"cache-control": "no-cache",
"connection": "close",
"date": "Sun, 20 Sep 2026 20:27:29 GMT",
"forwarded": "for=3.83.202.236;host=echo.it.shmuky.dev;proto=https;sig=0QmVhcmVyIDZhZTdkYTNjYTkyZWE0ODZmYzZiNjhlNDUxYzY4YmE5NjljMTJjNzM1NmQ1NjViZmViZmQ4M2NlZjI3MDQ5Y2E=;exp=1789936348",
"host": "echo.it.shmuky.dev",
"pragma": "no-cache",
"sec-fetch-mode": "cors",
"user-agent": "node",
"x-forwarded-for": "3.83.202.236",
"x-forwarded-host": "echo.it.shmuky.dev",
"x-forwarded-proto": "https",
"x-invocation-id": "cle1:iad1::cvlbp-1789936048974-df5b7ec88c39",
"x-matched-path": "/sites/echo",
"x-real-ip": "3.83.202.236",
"x-vercel-deployment-url": "it-shmuky-ckox61167-delta-capital.vercel.app",
"x-vercel-enable-rewrite-caching": "1",
"x-vercel-forwarded-for": "3.83.202.236",
"x-vercel-id": "cle1:iad1::cvlbp-1789936048974-df5b7ec88c39",
"x-vercel-ip-as-number": "14618",
"x-vercel-ip-city": "Ashburn",
"x-vercel-ip-continent": "NA",
"x-vercel-ip-country": "US",
"x-vercel-ip-country-region": "VA",
"x-vercel-ip-latitude": "39.0469",
"x-vercel-ip-longitude": "-77.4903",
"x-vercel-ip-postal-code": "20149",
"x-vercel-ip-timezone": "America/New_York",
"x-vercel-ja4-digest": "t13d5212h1_b262b3658495_8e6e362c5eac",
"x-vercel-oidc-token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Im1yay00MzAyZWMxYjY3MGY0OGE5OGFkNjFkYWRlNGEyM2JlNyJ9.eyJwcm9qZWN0X2lkIjoicHJqX1RVTlUxUk9sODhKbHQwY25sWlJRUVFsMzRnMWQiLCJvd25lcl9pZCI6InRlYW1fV1lqb3huUU4yVUE0QmZDYWIxc1V5RkFLIiwicGxhbiI6InBybyIsInByb2plY3QiOiJpdC1zaG11a3ktZGV2Iiwic2NvcGUiOiJvd25lcjpkZWx0YS1jYXBpdGFsOnByb2plY3Q6aXQtc2htdWt5LWRldjplbnZpcm9ubWVudDpwcm9kdWN0aW9uIiwic3ViIjoib3duZXI6ZGVsdGEtY2FwaXRhbDpwcm9qZWN0Oml0LXNobXVreS1kZXY6ZW52aXJvbm1lbnQ6cHJvZHVjdGlvbiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsIm5iZiI6MTc4OTkzMzQ3OSwiaXNzIjoiaHR0cHM6XC9cL29pZGMudmVyY2VsLmNvbVwvZGVsdGEtY2FwaXRhbCIsIm93bmVyIjoiZGVsdGEtY2FwaXRhbCIsImF1ZCI6Imh0dHBzOlwvXC92ZXJjZWwuY29tXC9kZWx0YS1jYXBpdGFsIiwiaWF0IjoxNzg5OTMzNDc5LCJleHAiOjE3ODk5NDA2Nzl9.PzcMABme2wpLefdCyiCJDjDfyS4GOlxwBXNj36vet2UFS9lLvKcRSiRHsllKOq5Lx5SPZXDFBn_gkFajHf-Z0dJ6UhLwu5E48hPqpW_E6VXyka3wSrXlLczjkERMDPtfjrfGbKqxfzRyrY06Yz8NeOovKdp0WK91FxoeQf0IEnA-oCl8Bl6OBkQpO2m-Fv7sfDqc1gOJPrAA6tMgPg_UiJeF28OSSen4T0FjOvxnzA1_r9SeGqo3jms9RE_9ubdv_yo2D-2cIWxa4hhklN75UU329Ah_kBeRGILqlyvedAh4AcSnHJFI9F9yPUzB5QmcOEHxh13dcAToBZ80AY9v-Q",
"x-vercel-proxied-for": "3.83.202.236",
"x-vercel-proxy-signature": "Bearer 6ae7da3ca92ea486fc6b68e451c68ba969c12c7356d565bfebfd83cef27049ca",
"x-vercel-proxy-signature-ts": "1789936348",
"x-vercel-sc-basepath": "",
"x-vercel-sc-headers": "{\"x-vercel-function-platform\":\"vercel\\/proxy+serverless\",\"x-vercel-ept\":\"0\",\"Authorization\":\"Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJzZXJ2ZXJsZXNzIiwiZG9tYWluIjoiZWNoby5pdC5zaG11a3kuZGV2Iiwib3duZXJJZCI6InRlYW1fV1lqb3huUU4yVUE0QmZDYWIxc1V5RkFLIiwidW5saW1pdGVkIjpmYWxzZSwicmVxdWVzdElkIjoiY3ZsYnAtMTc4OTkzNjA0ODk3NC1kZjViN2VjODhjMzkiLCJkZXBsb3ltZW50SWQiOiJkcGxfSHFUclZrUlRXcnVDcm5SdGp6N29FWlVMdm1ORSIsImV4cCI6MTc4OTkzOTY2OSwicHJvamVjdElkIjoicHJqX1RVTlUxUk9sODhKbHQwY25sWlJRUVFsMzRnMWQiLCJwbGFuIjoicHJvIiwibmV4dFZlcnNpb24iOiIxNi4zLjUiLCJlbnYiOiJwcm9kdWN0aW9uIiwiYmxvY2siOmZhbHNlLCJpYXQiOjE3ODk5MzYwNDl9.i-z5hFU4UhRWw8iE0cyED0MlOiwu6_1IWmC5qTLUTgU\"}",
"x-vercel-sc-host": "iad1.suspense-cache.vercel-infra.com"
}
}04
Every subdomain
05